MAL-2026-13606

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cdktn-provider-azurerm/MAL-2026-13606.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13606
Published
2026-08-07T12:36:48Z
Modified
2026-08-07T13:21:02.174430444Z
Summary
Malicious code in cdktn-provider-azurerm (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e)

Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm (CDK for Terraform), with a single-character substitution (cdktf → cdktn) and fabricated 'CDK Terrain' branding at cdktn.io that mirrors HashiCorp's cdk.tf. PKG-INFO declares Requires-Dist: cdktn<0.25.0,>=0.24.0, forcing installation of a non-HashiCorp base package cdktn (analogue of the legitimate cdktf). The top-level module executes import cdktn._jsii at load time via src/cdktnproviderazurerm/_jsii/init.py, so any code shipped in the attacker-controlled cdktn base runs in the installer's Python process the first time the provider is imported. README and metadata further reference cdktn-io/cdktn-provider-azurerm and a nonexistent open-constructs/cdk-terrain issue tracker, engineered to look identical to real HashiCorp CDKTF branding.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T12:36:48Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017051",
            "versions": [
                "17.0.0"
            ],
            "sha256": "e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e",
            "import_time": "2026-08-07T12:51:24.011415058Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / cdktn-provider-azurerm

Package

Name
cdktn-provider-azurerm
View open source insights on deps.dev
Purl
pkg:pypi/cdktn-provider-azurerm

Affected ranges

Affected versions

17.*
17.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/cdktn-provider-azurerm/MAL-2026-13606.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "f4d459ba8476f82d23c38a2930aea087671ba083c68256d2757e41b0d46480eb",
            "path": "PKG-INFO",
            "tlsh": "aaa141b7c89089a05f620de0bc8baac8f72f215d589c90d898a7c475f263df2877e055"
        },
        {
            "sha256": "4f5f05fdc0b4cea7626c2d8e6cceb70e8ad0dfc96dd255522b976929dc34e2cd",
            "path": "README.md",
            "tlsh": "32710ebbc82089619f610de07cc7a9c8f76f309d54a8a1d9849bc870b277cf6477b091"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "blake2b_256": "75a526033c4cad7530d1314502b81bccce432cd65d5041923dbc811e082d5b6c",
                "md5": "f7a765175b0372eee0f4e8a40d499587",
                "sha256": "c3ae5e82028d9ba9157a9ec7ff8b91407d044cf81147ab7cd397dffa6c32fb0e"
            },
            "filename": "cdktn_provider_azurerm-17.0.0-py3-none-any.whl"
        },
        {
            "hashes": {
                "blake2b_256": "f7abf0c0a70a41ac8e87cec535433b9310256ced7427e1544d47b0924ae13ad1",
                "md5": "524ce22c1bcf3080235f5e3ac1cc7101",
                "sha256": "131663a89a726fe804e01c3c5bde63be977dbcb09e9f06efbec6d776732ab7fe"
            },
            "filename": "cdktn_provider_azurerm-17.0.0.tar.gz"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]